shareplay-activities

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a communication interface that processes data received from peer participants in a shared session.\n
  • Ingestion points: Untrusted data enters the agent context via messenger.messages(of:) calls in the DrawingManager, SharePlayManager, and QuizManager components found in references/shareplay-patterns.md.\n
  • Boundary markers: Absent. The skill does not provide instructions to include delimiters or warnings to ignore potentially malicious embedded instructions in the peer messages.\n
  • Capability inventory: The skill's handlers are limited to updating local application state, such as managing drawing strokes, participant lists, and score tracking. No high-privilege capabilities like file system modifications or external network requests are present within these handlers.\n
  • Sanitization: Absent. The logic relies on standard Codable decoding but lacks specific validation, filtering, or escaping of the received message content.\n- [EXTERNAL_DOWNLOADS]: The skill contains references to documentation hosted on a non-official external domain.\n
  • Evidence: SKILL.md includes multiple links to https://sosumi.ai/documentation/groupactivities and its subdirectories.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 12:02 PM